Back to home

Privacy Policy

This document is published in English, which is its authoritative version.

Last updated: [DATE — to be set on final approval]

1. Who We Are

This Privacy Policy explains how Savana Software Solutions PLC ("Savana," "we," "us," "our"), operator of the Amod platform, collects, uses, stores, and protects personal and business data.

2. What Data We Collect

From account owners and staff:

  • Phone number (used for account creation, OTP verification, and PIN-based login)
  • Full name and role within the business
  • PIN (stored as a secure one-way hash, never in plain text)

From business operations (entered by you or your staff):

  • Sales, inventory, and transaction records
  • Customer records you choose to store (e.g. names, phone numbers, credit balances)
  • Financial data (revenue, costs, payment records) generated through your use of Amod

Automatically collected:

  • Basic technical data needed to operate the service (error logs, security events such as failed login attempts, device/session metadata)
  • We do not log full phone numbers or PINs in error/security logs — only counts and non-identifying event types (see RULES.md M1, structured logging and credential exclusion).

3. Why We Collect It

  • To create and secure your account (phone + OTP + PIN authentication)
  • To provide the core service — point-of-sale, inventory, and accounting functionality
  • To detect and prevent fraud, abuse, and unauthorized access
  • To send you service-related notifications (e.g. via SMS/Telegram, as you configure)
  • To monitor the health and security of the platform (error tracking, uptime monitoring)

We do not use your business data for advertising, and we do not sell your data to third parties.

4. Where Your Data Is Stored

  • Application data (transactions, inventory, staff records) is stored in our database infrastructure, hosted in the European Union (EU) region.
  • Offline data is stored locally on your device until it syncs to our servers.

5. Third Parties We Share Data With

We use the following categories of infrastructure providers to operate Amod. Each processes only the data necessary for its function:

| Purpose | Provider | Data involved | |---|---|---| | Database & authentication | Supabase | Account data, business data (EU-hosted) | | Error monitoring | Sentry | Technical error data (scrubbed of PII before sending) | | SMS / OTP delivery | [Provider — to be finalized] | Phone number, verification code | | Notifications | Telegram | Delivery notifications only (opt-in) | | Payment processing | [Provider — to be finalized] | Transaction data, per provider's own terms |

[Placeholder — final list to be confirmed once each integration (SMS/OTP, payment gateway) is selected and built.]

We do not permit these providers to use your data for their own purposes beyond providing the service to us.

6. How We Protect Your Data

  • Every business's data is isolated from every other business's data (tenant isolation), enforced at the database level.
  • PINs are never stored in plain text.
  • Access to sensitive actions (e.g. changing security settings) requires re-verification even on an already-logged-in device.
  • Money- and stock-affecting actions are recorded in a tamper-evident audit log.
  • [Placeholder — retention periods, breach notification process, and any compliance certifications to be added following legal review.]

7. Your Rights

As the operator of your business account, you can:

  • Access and review the data your business has stored in Amod at any time through the Platform.
  • Request an export of your data. [Placeholder — self-service export feature not yet built; tracked in the product roadmap. Until available, contact us directly.]
  • Request deletion of your account and associated data, subject to any legal retention obligations (e.g. financial record-keeping requirements). [Placeholder — exact retention period pending legal review.]

8. Data From Your Customers

If you store your own customers' information in Amod (e.g. name, phone number, credit balance), you are responsible for having the appropriate basis to collect and store that information under applicable law. Amod acts as a data processor on your behalf for this data; you remain the data controller.

9. Children's Data

Amod is a business tool not intended for use by individuals under the age of 18. We do not knowingly collect data from minors.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to account owners in advance.

11. Contact

For any privacy-related questions or requests:

Savana Software Solutions PLC [Registered address — placeholder] [Contact email — placeholder]

*This document was drafted as a starting point and is pending legal review. Do not rely on it as a finalized legal or compliance document.*